I'm running snort Version 1.8.2-beta1 (Build 85) logging to mysql under
Linux 7.0 I am using ACID v0.9.6b17 to view the database.
I have the following rule where I added a tag to log more of the
session. Snort doesn't give me an error on start up but I'm not seeing
any other packets being logged to mysql.
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd.exe
access"; flags: A+; content:"cmd.exe"; tag: session, 60, seconds;
nocase; classtype:web-application-attack; sid:1002; rev:2;)
Am I placing the tag in the wrong area of the rule?
Otherwise snort runs beautifully. :-)
Thanks in advance.
--
Quidquid latine dictum sit, altum viditur.
http://www.jcsmall.com/homepage